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STATUS OF CLAIMS 
Claims 1-20 stand finally rejected under 35 U.S.C. § 103(a). Claims 1-20 are appealed. 

STATUS OF AMENDMENTS 
There has been no amendment filed subsequent to the final rejection. However, a Response 
to Final Office Action was filed on July 8, 2003, along with the Notice of Appeal. 

SUMMARY OF INVENTION 

The present invention provides techniques for use in analyzing non-fully structured data 
which is associated with one or more events. In one aspect, a technique of the invention comprises 
the following steps. At least a portion of the non-fully structured data is parsed according to one or 
more parsing rules to convert the at least a portion of non-fully structured data to structured data. 
Presentation operations are provided which are respectively able to provide a presentation of at least 
a portion of the non-fully structured data, format at least a portion of the structured data to provide 
a presentation of a graphical representation of the at least a portion of structured data, and format at 
least a portion of the structured data to provide a presentation of a summary representation of the at 
least a portion of structured data. Data associated with two or more of the presentations is 
coordinated, when desired, to enable a coordinated analysis of the data (Specification, page 6, line 
3, through page 7, line 2; and page 20, lines 3-12). 

Thus, the present invention provides systems and methods for providing exploratory analysis 
of data for event management. In an illustrative embodiment, the invention provides for a 
methodology and related system referred to hereinafter as an "event browser" that provides an 
integrated environment for analysis of a large volumes of semi-structured or non-structured data, 
such as event logs. In such an illustrative embodiment of the invention, the event browser 
advantageously provides: (1) scalable analysis of large volumes of unstructured data with diverse 
content and data formats; (2) an architecture to support multiple types of views and analyses of such 
data; (3) mechanisms to support the iterative refinement of the information in the raw data that is 
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included in the visualization and analysis environment; (4) several specific viewers for analysis of 
event data (Specification, page 4, lines 9-19). 

An event browser of the invention may be implemented in a form which includes certain 
functional components. To deal with textual messages directly, the event browser of the invention 
may integrate a parsing mechanism or engine (e.g., parser 20 of FIG. 1) and an analysis tool (e.g., 
analysis tool 25 of FIG. 1) in one package. The role of the parsing engine may be to translate an 
event message into a set of attribute values defined by parsing rules (e.g., rules 30 of FIG. 1). For 
example, if parsing rules define information about host name, event type and time stamp, an event 
message is translated into a tuple of {host name, event type, time} through the parsing. In other 
words, the parsing engine may translate semi-structured or non- structured textual data into structured 
data. The analysis tool, therefore, does not need to worry about the detailed message format, and can 
focus on analysis and the GUI (graphical user interface) to an end-user. As a result, the detailed 
textual format of a log file is preferably hidden from an end-user, until he wants to see it. This 
allows users to analyze log files with different formats in a unified and simple way (Specification, 
page 4, line 20, through page 5, line 6). 

To take advantages of different analysis techniques, an event browser of the invention may 
provide an extensible architecture to integrate event graphs (e.g., "plot viewer" as illustrated in FIG. 
14), event summarization (e.g., "attribute viewer" as illustrated in FIG. 12), detailed message ( e.g., 
"message viewer" as illustrated in FIG. 17) and other possible viewers. Further, the event browser 
may provide an infrastructure for exchanging information amongst the viewers. Each of these three 
viewers has its own advantages for viewing and manipulating data. For example, the attribute 
viewer of the invention may be good at summarization and query-type operations. From the attribute 
viewer, a user may conveniently select all events associated with a set of hosts and event types. It 
also may summarize events by their host types and event types and thus provide summarization of 
a log to a user. The plot viewer of the invention may display a large amount of individual events in 
one window. Therefore, a user may view event relationships and discover event patterns. In 
addition, through the use of standard visualization techniques, a user may zoom in for details and 
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zoom out for a larger view, and rubber-band to select "interesting" events. The message viewer of 
the invention may provide the capability to view a set of raw event messages. This may enable a 
user to further see detailed and application specific information which may be very difficult to parse 
out or not worth parsing out, but may be needed for diagnosis (Specification, page 6, lines 6-18). 

The event browser of the invention may not only provide these three individual viewers, but 
also may combine and coordinate two or more of these viewers for analyzing events. For example, 
a user can very easily select a set of interesting events for a set of hosts and event types from the 
attribute viewer by highlighting these hosts and event types, then use the plot viewer to see the 
relationship among the selected events. From the plot viewer, he can further select a small set of 
suspicious events by dragging a rubber-band, and displaying the original textual messages related 
to the selected events in the message viewer. Further, by highlighting, coloring, or otherwise 
selecting events in one viewer, he can cause to have similarly modified presentations of these events 
in other viewers. This capability is referred to as "coordinated views." Accordingly, the event 
browser provides a novel event visualization and analysis platform and can assist a user in 
discovering "useful" information which can not be revealed by any conventional tool (Specification, 
page 6, line 19, through page 7, line 2). 

In another aspect of the invention, the event browser may provide interactive and iterative 
refinement of parsing rules. A role of a parsing engine is to pick out the important information from 
textual messages and translate the unstructured data into structured data for analysis. Therefore, the 
ability of analysis tools highly depends on what is parsed. In practice, finding the right information 
to parse out from a message is not an easy task, because a raw message contains various levels of 
details and a user certainly does not want to be flooded by this information. Usually, at first, a user 
is only interested in the most important information, such as host name and event type. But as the 
user analyzes the data, the user may want more details or other types of information, such as 
destination or severity level. Therefore, the parsing rule needs to be redefined to include additional 
information. Conventionally, the process of defining parsing rules is done in an isolated way. That 
is, if a user needs more information, the user has to use a separate tool to edit the parsing rule file, 
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and then rerun the parsing and the analysis. Since the event browser integrates parsing engine and 
analysis, it provides a feedback loop for a user to modify parsing rules in an integrated environment 
(Specification, page 7, lines 3-17). 

ISSUE PRESENTED FOR REVIEW 
Whether claims 1-20 are unpatentable under 35 U.S.C. §103(a) over U.S. Patent No. 
6,118,936 to Lauer (hereinafter "Lauer") in view of Appellants' specification at page 2, lines 18, 19, 
26 and 27 (hereinafter "alleged APA") and further in view of David A. Rabenhorst, "Interactive 
Exploration of Multidimensional Data," Proceedings of the SPIE Symposium on Electronic Imaging, 
February 1994 (hereinafter "Rabenhorst"). 

GROUPING OF CLAIMS 
Claims 1, 2, 4-13 and 15-20 stand or fall together. Claims 3 and 14 stand or fall together. 

ARGUMENT 

Appellants incorporate by reference herein the disclosure of all previous responses filed in 
the present application, namely: an Amendment and Response to Office Action dated January 13, 
2003; and a Response to Final Office Action dated July 8, 2003. 

Before presenting substantive arguments, Appellants respectfully point out that a petition for 
a two-month extension of time has been filed concurrent with this Appeal Brief. However, 
Appellants believe that such an extension was necessitated due to an unreasonable delay on the part 
of the U.S. Patent and Trademark Office in responding to Appellants 1 Response to Final Office 
Action. That is, Appellants filed the Response to Final Office Action and Notice of Appeal on July 
8, 2003 , which was stamped as being received by OPIE on July 1 0, 2003 . Nonetheless, after making 
several inquiries to the U.S. Patent and Trademark Office, including to the Examiner, Appellants did 
not receive an Advisory Action until over 3 X A months after filing the Response to Final Office 
Action and Notice of Appeal, i.e, October 30, 2003, thus necessitating the two-month extension of 
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time. Appellants respectfully request reimbursement of the fee associated with the extension of time 
to the degree that the delay was not caused by Appellants. 

Turning now to the substantive issue of whether claims 1-20 are unpatentable under 35 
U.S.C. § 1 03(a) over Lauer in view of the alleged APA in further view of Rabenhorst, the final Office 
Action contends that the cited combination discloses all of the claim limitations recited in the subject 
claims. Appellants respectfully assert that the cited combination fails to establish a prima facie case 
of obviousness under 35 U.S.C. §103(a), as specified in M.P.E.P. §2143. 

As set forth therein, M.P.E.P. §2143 states that three requirements must be met to establish 
a prima facie case of obviousness. First, there must be some suggestion or motivation to combine 
reference teachings. Second, there must be a reasonable expectation of success. Third, the cited 
combination must teach or suggest all the claim limitations. While it is sufficient to show that a 
prima facie case of obviousness has not been established by showing that one of the requirements 
has not been met, Appellants respectfully believe that none of the requirements have been met. 

As pointed out in Appellants' previous responses, the present invention, for example as 
recited in independent claim 1, defines a processor-based method for use in analyzing non- fully 
structured data which is associated with one or more events, comprising the following steps. At least 
a portion of the non- fully structured data is parsed according to one or more parsing rules to convert 
the at least a portion of non-fully structured data to structured data. Presentation operations are 
provided which are respectively able to provide a presentation of at least a portion of the non-fully 
structured data, format at least a portion of the structured data to provide a presentation of a graphical 
representation of the at least a portion of structured data, and format at least a portion of the 
structured data to provide a presentation of a summary representation of the at least a portion of 
structured data. Data associated with two or more of the presentations is coordinated, when desired, 
to enable a coordinated analysis of the data. Independent claim 9 defines a system-based invention 
having similar limitations, while independent claim 1 2 and independent claim 20 respectively define 
an apparatus-based invention and an article of manufacture-based invention having similar 
limitations. 
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Lauer is directed to a signaling network management system for converting network events 
into standard form and then correlating the standard form events with topology and maintenance 
information. The alleged APA on page 2 of Appellants' specification refers to mutually exclusive 
data viewing approaches, i.e., viewing raw data, viewing summary information, and viewing 
graphical displays. Rabenhorst is directed to a multidimensional data-based graphical tool referred 
to as "Diamond." 

First, Appellants reassert that no motivation or suggestion exists to combine Lauer, the 
alleged APA, and Rabenhorst. For at least this reason, a prima facie case of obviousness has not 
been established. As asserted in Appellants' previous responses, motivation to combine cannot 
come from the [Appellants '1 own specification . This is impermissible hindsight. In fact, 
Appellants' specification points out the very deficiencies from which approaches such as those 
taught by Lauer and Rabenhorst (Diamond) suffer. 

Appellants' specification at page 2, line 18, through page 4, line 7 (the source of the alleged t 
APA) describes three different, but mutually exclusive , ways to analyze event logs, i.e, viewing raw 
data, viewing summary information, and viewing graphical displays. As pointed out, each of them 
has its own advantages. Directly reading the textual messages provides the most detailed 
information of event messages. The aggregated event analysis provides a nice scaling property and 
shows summarization. The event plot can reveal event patterns and relationship among events. 
Most available products for analyzing a log file specialize on one type of log file. Unfortunately, all 
of these special log analyzers only support summarization analysis. None of them can be used to 
visualize event messages and/or see original messages. On the other hand, there are many general 
graphical tools. These tools aim to support either graphical analysis of numerical data or aggregated 
level summarization. However, none of them provide both types of analysis. In addition, these tools 
usually only take structured data as inputs and can not handle textual data directly. 

Further, Appellants' specification points out that there are many general graphical tools, such 
as Diamond (see, e.g., Rabenhorst), Data explorer, SAS, PowerPlay, etc. These tools aim to support 
either graphical analysis of numerical data, such as Diamond , Data explorer, SAS, etc., or aggregated 
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level summarization such as PowerPlay and other OLAP (On Line Analytical Process) products. 
However, none of them provide both types of analysis. In addition, these tools usually only take 
structured data as inputs and can not handle textual data directly. 

Therefore, as the specification explains, it would be highly desirable to provide systems and 
methods which integrate different analysis approaches, thus providing a user with the capability and 
flexibility to perform multiple types of analysis on raw data for event management purposes. This 
is what the claimed invention is directed toward . 

Despite the Examiner's contention, there is nothing in Lauer nor Rabenhorst that would 
suggest motivation to yield the integrated presentation and analysis approach of the claimed 
invention. Further, since the approaches described in the specification are generally mutually 
exclusive, there is no known motivation to combine any of them into a single presentation and 
analysis technique, as in the claimed invention. 

Furthermore, the Federal Circuit has stated that when patentability turns on the question of 
obviousness, the obviousness determination "must be based on objective evidence of record" and 
that "this precedent has been reinforced in myriad decisions,, and cannot be dispensed with." In re 
Lee , 277 F.3d 1338, 1343 (Fed. Cir. 2002). Moreover, the Federal Circuit has stated that 
"conclusory statements" by an examiner fail to adequately address the factual question of motivation, 
which is material to patentability and cannot be resolved "on subjective belief and unknown 
authority." Id. at 1343-1344. 

In the final Office Action at page 3 , the Examiner provides the following statements to prove 
motivation to combine Lauer, the alleged AP A, and Rabenhorst, with emphasis supplied: "[i]t would 
have been obvious to apply the teachings of APA to the system of Lauer because this provides the 
user different approaches to view the structured data . . . [i]t would have been obvious to apply the 
teachings of [Rabenhorst] to the system of Lauer for analysis purpose because the user can view 
different representations of the data at the same time; therefore performing general operations upon 
the data as disclosed bv [Rabenhorst! ." 
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Appellants again submit that these statements are based on the type of "subjective belief and 
unknown authority" that the Federal Circuit has indicated provides insufficient support for an 
obviousness rejection. More specifically, the Examiner fails to identify any objective evidence of 
record which supports the proposed combination. Again, motivation to combine cannot come from 
the Appellants' own specification . 

Second, Appellants reassert that there is no reasonable expectation of success in achieving 
the present invention through a combination of Lauer, the alleged APA, and Rabenhorst. For at least 
this reason, a prima facie case of obviousness has not been established. As mentioned above, despite 
the assertion in the outstanding final Office Action, Appellants do not believe that Lauer, the alleged 
APA, and Rabenhorst are combinable since it is not clear how one would combine them given that 
the various approaches are mutually exclusive. There are no teachings in the cited combination as 
to how to coordinate data associated with two or more of the presentations, when desired, to enable 
a coordinated analysis of the data, as in the claimed invention. 

Lastly, Appellants reassert that the combination of Lauer, the alleged APA, and Rabenhorst 
fails to teach or suggest all of the claim limitations of independent claims 1,9, 12 and 20. For at 
least this reason, a prima facie case of obviousness has not been established. Again, assuming 
arguendo that Lauer, the alleged APA, and Rabenhorst could be properly combined, which for at 
least the reasons above it is believed that they can not be properly combined, the combination fails 
to teach or suggest all claim elements in independent claims 1,9, 12 and 20. 

By way of example, the inventions of claims 1, 9, 12 and 20 recite "coordinating data 
associated with two or more of the presentations, when desired, to enable a coordinated analysis of 
the data." This is explained, for example, at page 6 of the specification where it is stated that the 
invention not only preferably provides multiple viewers, but also combines and coordinates these 
viewers for analyzing events. For example, a user can very easily select a set of interesting events 
for a set of hosts and event types from the attribute viewer (e.g., summary viewing) by highlighting 
these hosts and event types, then use the plot viewer (e.g., graphical viewing) to see the relationship 
among the selected events. From the plot viewer, he can further select a small set of suspicious 
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events by dragging a rubber-band, and displaying the original textual messages related to the selected 
events in the message viewer (e.g., raw data viewing). Further, by highlighting, coloring, or 
otherwise selecting events in one viewer, he can cause to have similarly modified presentations of 
these events in other viewers. 

Assuming arguendo that it is proper to combine Lauer, the alleged APA, and Rabenhorst to 
yield a group of presentation techniques, the cited combination is silent as to "coordinating data 
associated with two or more of the presentations, when desired, to enable a coordinated analysis of 
the data," as expressly recited in independent claims 1,9,12 and 20. The final Office Action points 
to section 4 of Rabenhorst ("Integrated Interaction") as teaching the claimed coordination feature. 
However, this section of Rabenhorst is very different than the claimed feature. As mentioned above, 
Rabenhorst is directed to a multidimensional data-based graphical tool referred to as Diamond. 
Thus, the presentations or visualizations that Diamond supports are limited to graphical presentations 
or visualizations, for example, see section 7 of Rabenhorst which names the graphical presentations 
or visualizations, e.g., scatter plots, snake plots, quad-wise plots, fractal foam plots, etc. The 
"integration" and "transformation" referred to in section 4 of Rabenhorst relates only to the different 
graphical presentations or visualizations , which is significantly different than the coordination 
feature of the claimed invention. 

Thus, Rabenhorst does not teach or suggest presentation operations which are respectively 
able to: (i) provide a presentation of at least a portion of the non- fully structured data (e.g., raw data 
viewing); (ii) format at least a portion of the structured data to provide a presentation of a graphical 
representation of the at least a portion of structured data (e.g., graphical viewing); and (iii) format 
at least a portion of the structured data to provide a presentation of a summary representation of the 
at least a portion of structured data (e.g., summary viewing), such that data associated with two or 
more of the presentations is coordinated, when desired, to enable a coordinated analysis of the data, 
as in the claimed invention. The scatter plot of FIG. 3 of Rabenhorst, relied upon by the Examiner, 
is merely a graphical presentation, not a summary representation. 
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For at least the above reasons, Appellants respectfully request withdrawal of the §103 
rejections of independent claims 1, 9, 12 and 20. 

The remainder of the claims rejected over the Lauer-alleged APA-Rabenhorst combination 
depend, either directly or indirectly, from claims 1, 9 or 12, which are believed patentable for the 
reasons set forth above. Furthermore, the remaining claims define additional patentable subject 
matter in their own right. 

By way of example only, claims 3 and 14 recite the step/operation of modifying one or more 
parsing rules to affect the parsing operation. The portion of Lauer cited to support this rejection (i.e., 
column 14, lines 50-52) deals with modifying a presentation, not modifying parsing rules. The final 
Office Action fails to address this deficiency. 

For at least the above reasons, Appellants respectfully request withdrawal of the §103 
rejections of dependent claims 2-8, 10, 1 1 and 13-19. 

In an Advisory Action dated October 28, 2003, the Examiner alleges that in "the request for 
reconsideration filed 7/10/2003 (Response to Final Office Action) . . . applicant argued the same 
arguments as set forth in the amendment received 01/2 1/2003 (Amendment and Response to Office 
Action). This is a mischaracterization of Appellants' arguments . Appellants respectfully point out 
that while the main deficiencies of the Examiner's rejections remain the same and were therefore 
similarly addressed in Appellants' Response to Final Office Action, even a cursory reading of the 
Response to Final Office Action indicates that Appellants' arguments attempted to address any and 
all points raised by the Examiner in the final Office Action. 
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Accordingly, for at least the foregoing reasons, claims 1 -20 are believed to be patentable over 
the cited references. As such, the application is asserted to be in condition for allowance, and 
favorable action is respectfully solicited. 



Respectfully submitted, 



Date: November 10, 2003 




Attorney for Applicant(s) 
Reg. No. 39,274 
Ryan, Mason & Lewis, LLP 
90 Forest Avenue 
Locust Valley, NY 11560 
(516) 759-2946 
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APPENDIX 

1 . (Previously Amended) A processor-based method for use in analyzing non- fully structured 
data which is associated with one or more events, the method comprising the steps of: 

parsing at least a portion of the non-fully structured data according to one or more parsing 
rules to convert the at least a portion of non-fully structured data to structured data; 

providing presentation operations which are respectively able to provide a presentation of at 
least a portion of the non-fully structured data, format at least a portion of the structured data to 
provide a presentation of a graphical representation of the at least a portion of structured data, and 
format at least a portion of the structured data to provide a presentation of a summary representation 
of the at least a portion of structured data; and 

coordinating data associated with two or more of the presentations, when desired, to enable 
a coordinated analysis of the data. 

2. (Original) The method of Claim 1, further comprising the step of providing coordinated 
views for at least two of the graphical representation, the summary representation and the non-fully 
structured data presentation. 

3. (Original) The method of Claim 1, further comprising the step of modifying the one or 
more parsing rules to affect the parsing operation. 

4. (Original) The method of Claim 1, further comprising the step of providing a rubber- 
banding operation in association with the graphical representation. 

5. (Original) The method of Claim 1, further comprising the step of providing a zooming 
operation in association with the graphical representation. 
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6. (Original) The method of Claim 1, wherein the summary representation includes one or 
more attributes associated with the at least a portion of structured data. 

7. (Original) The method of Claim 1, further comprising the step of providing a selection 
operation in association with aspects of at least one of the non-fully structured data and the structured 
data. 

8. (Original) The method of Claim 1, further comprising the step of providing a filtering 
operation in association with aspects of at least one of the non-fully structured data and the structured 
data. 

9. (Previously Amended) A system for use in analyzing non-fully structured data which is 
associated with one or more events, the system comprising: 

a parsing engine which parses at least a portion of the non-fully structured data according to 
one or more parsing rules to convert the at least a portion of non-fully structured data to structured 
data; 

viewers which are respectively able to provide a presentation of at least a portion of the non- 
fully structured data, format at least a portion of the structured data to provide a presentation of a 
graphical representation of the at least a portion of structured data, and format at least a portion of 
the structured data to provide a presentation of a summary representation of the at least a portion of 
structured data , wherein data associated with two or more of the presentations is coordinated, when 
desired, to enable a coordinated analysis of the data; and 

a selection and control engine coupled to the parsing engine and the viewers which controls 
operations associated with the parsing engine and the viewers. 

1 0. (Original) The system of Claim 9, wherein the operations controlled by the selection and 
control engine include at least one of data and parsing rule access. 
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1 1 . (Original) The system of Claim 9, wherein the operations controlled by the selection and 
control engine include communications between the viewers. 

12. (Previously Amended) Apparatus for use in analyzing non-fully structured data which 
is associated with one or more events, the apparatus comprising: 

at least one processor operable to: (i) parse at least a portion of the non-fully structured data 
according to one or more parsing rules to convert the at least a portion of non-fully structured data 
to structured data; (ii) provide presentation operations which are respectively able to provide a 
presentation of at least a portion of the non-fully structured data, format at least a portion of the 
structured data to provide a presentation of a graphical representation of the at least a portion of 
structured data, and format at least a portion of the structured data to provide a presentation of a 
summary representation of the at least a portion of structured data; and (iii) coordinate data 
associated with two or more of the presentations, when desired, to enable a coordinated analysis of 
the data; and 

memory coupled to the at least one processor for storing at least one of the non-fully 
structured data, the structured data and the one or more parsing rules. 

13. (Original) The apparatus of Claim 12, wherein the at least one processor is further 
operable to provide coordinated views for at least two of the graphical representation, the summary 
representation and the non-fully structured data presentation. 

14. (Original) The apparatus of Claim 12, wherein the at least one processor is further 
operable to modify the one or more parsing rules to affect the parsing operation. 

15. (Original) The apparatus of Claim 12, wherein the at least one processor is further 
operable to provide a rubber-banding operation in association with the graphical representation. 
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16. (Original) The apparatus of Claim 12, wherein the at least one processor is further 
operable to provide a zooming operation in association with the graphical representation. 

1 7. (Original) The apparatus of Claim 1 2, wherein the summary representation includes one 
or more attributes associated with the at least a portion of structured data. 

18. (Original) The apparatus of Claim 12, wherein the at least one processor is further 
operable to provide a selection operation in association with aspects of at least one of the non-fully 
structured data and the structured data. 

19. (Original) The apparatus of Claim 12, wherein the at least one processor is further 
operable to provide a filtering operation in association with aspects of at least one of the non-fully 
structured data and the structured data. 

20. (Previously Amended) An article of manufacture for use in analyzing non-fully 
structured data which is associated with one or more events, comprising a machine readable medium 
containing one or more programs which when executed implement the steps of: 

parsing at least a portion of the non-fully structured data according to one or more parsing 
rules to convert the at least a portion of non-fully structured data to structured data; 

providing presentation operations which are respectively able to provide a presentation of at 
least a portion of the non-fully structured data, format at least a portion of the structured data to 
provide a presentation of a graphical representation of the at least a portion of structured data, and 
format at least a portion of the structured data to provide a presentation of a summary representation 
of the at least a portion of structured data; and 

coordinating data associated with two or more of the presentations, when desired, to enable 
a coordinated analysis of the data. 
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